lordbobcup
Hi,
I have installed and configured OpenVPN community on Ubuntu specific version is 2.4.3-4. The problem I am facing is external connections are limited to 40mbps almost exactly. I can copy an ISO over it and it will flat line at 40mbps. No peaks and troughs , so it looks like a cap rather than maxing out a connection.
Site A (Server) is 100mbps/100mbps fibre -> Internet <- Site B (client) is 100mbps/100mbps. We have no trouble using other VPN products like AnyConnect etc so we know bandwidth isn't a problem here.
If I connect a client in the same site as the server (1gbps LAN) I can easily push and pull >600mbps using AES-128-CBC so we know the server is functioning fine. This definitely looks like a Internet issue but it cant be a client side internet issue as another OpenVPN I can connect to from the client site can easily max out the 100mbps internet link.
So now I am left to the configuration on the 'WAN' at the server side, which is basically just an Cisco ASA5510 firewall, or some sort of MTU setting etc. I know the MTU between the client and server is 1472, this is the same MTU the client uses when connecting to the other OpenVPN where he can pull 100mbps from so it seems unlikely any specific MTU/MSS settings are required as there are none present in the working OpenVPN Client config. I have also tried send/receive buffers at 0 and 393216 neither of which made any difference at all, still hit 40mbps and sat there.
CPU load on both client and server during this testing is < 20% and both CPUs support AES-NI.
I have made the 2 client Configs the same using the same settings the best I can (I only run one of the servers not both so I cant compare server configs), but no combination of client configurations can get past this 40mbps cap.
Currently im using UDP protocol, but I have also tried TCP and there doesn't appear to be any kind of difference at all 40mbps still appears to be the common number and I cant work out why.
[oconf=]local 172.17.18.253
port 10000
proto udp
dev tun
ca ca.crt
cert vpn.crt
key vpn.key # This file should be kept secret
dh dh2048.pem
topology subnet
server 172.17.17.0 255.255.255.128
ifconfig-pool-persist ipp.txt
push "route 172.17.15.0 255.255.255.0"
push "route 172.17.18.0 255.255.255.0"
push "dhcp-option DNS 172.17.15.10"
push "dhcp-option DNS 172.17.15.8"
keepalive 10 120
cipher AES-128-CBC
compress lz4-v2
push "compress lz4-v2"
user nobody
group nogroup
persist-key
persist-tun
status openvpn-fullaccess-status.log
log-append openvpn-fullaccess.log
verb 4
explicit-exit-notify 1
client-cert-not-required
username-as-common-name
script-security 3
auth-user-pass-verify auth/ldap-check-user.sh via-env
push "dhcp-option DOMAIN xxx.com"
sndbuf 393216
rcvbuf 393216
link-mtu 1460
[/oconf]
[oconf=]
client
dev tun
proto tcp
remote 1.2.3.4 10000
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.cert
auth-user-pass
auth-retry nointeract
verb 3
cipher AES-128-CBC
ns-cert-type server
route-method exe
route-delay 2
win-sys env
sndbuf 393219
rcvbuf 393216
comp-lzo
[/oconf]
Can anyone see anything glaringly obvious that I may have missed? Or do you think im looking at ISP related issues on the server side?
Thanks in advance.
